A method of detecting the manipulation of a programmable memory device of the type defined above is known, for example, from German Published Patent Application No. 196 15 105. A controller described there contains a microcomputer, a first programmable memory device and a second programmable memory device. The first memory device is designed as an erasable non-volatile flash EPROM. The second memory device is designed as an EEPROM. Data and control programs for operation of the controller and for control/regulation of certain functions of the motor vehicle are stored in the first programmable memory device. For execution of the control/regulatory functions assigned to the microcomputer and for self-control, the microcomputer processes the control programs which are stored in the first memory device together with data that might be needed to execute the programs.
For programming/reprogramming the controller, an external programming unit is provided and is connected by a serial interface to the controller. The programming unit causes the controller to erase the data and/or control programs stored in the first memory device and then causes a new control program and/or new data to be stored in the first programmable memory device.
In conjunction with programming/reprogramming the first memory device, i.e., before, during and/or after erasing and/or overwriting the first memory device, the programming/reprogramming operation is documented by storing the corresponding information in the second programmable memory device. Storing the information during the programming/reprogramming operation is preferable because, due to time interleaving of the programming/reprogramming of the first memory device and the storage of information in the second memory device, the possibility of reprogramming the first memory device without storing information regarding the programming/reprogramming operation in the second memory is extremely low.
Various conclusions can be drawn on the basis of the information stored in the second memory device. First, disturbances in programming/reprogramming the controller due to a defective external programming unit can be detected rapidly and correctly. Second, unauthorized manipulation of the control program in the first memory device can be detected and sometimes even traced back to the unauthorized manipulator on the basis of the stored information. Detection of an unauthorized manipulation of the controller is important because defects in the controller or in the units of the motor vehicle controlled or regulated by the controller can occur due to a faulty control program or a control program not aimed at error-free operation of the internal combustion engine of the motor vehicle. Unauthorized manipulation of the control program usually makes any warranty or liability claims null and void.
A disadvantage of the method known from the related art is that it cannot readily be used with a traditional controller which has only the first programmable memory device. The controller is first expanded by the second programmable memory device. In addition, the microcomputer of the controller not only has access to the first memory device but also has access to the second programmable memory device. The information regarding the programming/reprogramming operation to be stored in the second memory device is also very complex, so the time for programming/reprogramming the memory device of the controller is greatly increased.
Furthermore, the second memory device is erased before storing the information. This means that the second memory device can also be erased by any unauthorized person having access to appropriate knowledge and hardware and can be overwritten with new information. Thus, with the method known from the related art, unauthorized manipulation of the control program of the controller cannot be detected reliably.